Mercurial > hg > orthanc-tests
annotate NewTests/Authorization/test_authorization.py @ 620:8ba9b20ae95f debug-pg-transactions
debug pg transactions tests
author | Alain Mazy <am@osimis.io> |
---|---|
date | Mon, 05 Feb 2024 22:32:39 +0100 |
parents | c28bd957cb93 |
children | 9f867dc595e2 |
rev | line source |
---|---|
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
1 import unittest |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
2 import time |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
3 import pprint |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
4 import subprocess |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
5 from helpers import OrthancTestCase, Helpers |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
6 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
7 from orthanc_api_client import OrthancApiClient, generate_test_dicom_file |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
8 from orthanc_api_client import exceptions as orthanc_exceptions |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
9 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
10 import logging |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
11 import pathlib |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
12 here = pathlib.Path(__file__).parent.resolve() |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
13 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
14 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
15 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
16 class TestAuthorization(OrthancTestCase): |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
17 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
18 label_a_study_id = None |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
19 label_b_study_id = None |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
20 no_label_study_id = None |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
21 auth_service_process = None |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
22 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
23 @classmethod |
577 | 24 def terminate(cls): |
578 | 25 |
26 if Helpers.is_docker(): | |
27 subprocess.run(["docker", "rm", "-f", "auth-service"]) | |
28 else: | |
29 cls.auth_service_process.terminate() | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
30 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
31 @classmethod |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
32 def prepare(cls): |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
33 test_name = "Authorization" |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
34 storage_name = "authorization" |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
35 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
36 print(f'-------------- preparing {test_name} tests') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
37 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
38 cls.clear_storage(storage_name=storage_name) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
39 |
577 | 40 auth_service_hostname = "localhost" |
41 if Helpers.is_docker(): | |
42 auth_service_hostname = "auth-service" | |
43 cls.create_docker_network("auth-test-network") | |
44 | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
45 config = { |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
46 "AuthenticationEnabled": False, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
47 "Authorization": { |
577 | 48 "WebServiceRootUrl": f"http://{auth_service_hostname}:8020/", |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
49 "StandardConfigurations": [ |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
50 "orthanc-explorer-2", |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
51 "stone-webviewer" |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
52 ], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
53 "CheckedLevel": "studies", |
577 | 54 "TokenHttpHeaders": ["user-token-key", "resource-token-key"], |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
55 "TokenGetArguments": ["resource-token-key"] |
578 | 56 }, |
57 "DicomWeb": { | |
58 "Enable": True | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
59 } |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
60 } |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
61 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
62 config_path = cls.generate_configuration( |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
63 config_name=f"{test_name}", |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
64 storage_name=storage_name, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
65 config=config, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
66 plugins=Helpers.plugins |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
67 ) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
68 |
577 | 69 if Helpers.is_exe(): |
70 # Start the auth-service application as a subprocess and wait for it to start | |
71 cls.auth_service_process = subprocess.Popen(["uvicorn", "auth_service:app", "--host", "0.0.0.0", "--port", "8020"], cwd=here) | |
72 time.sleep(2) | |
73 else: | |
74 # first build the docker image for the auth-service | |
75 subprocess.run(["docker", "build", "-t", "auth-service", "."], cwd=here) | |
76 cls.auth_service_process = subprocess.Popen(["docker", "run", "-p", "8020:8020", "--network", "auth-test-network", "--name", "auth-service", "auth-service"]) | |
579 | 77 time.sleep(5) |
577 | 78 |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
79 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
80 if Helpers.break_before_preparation: |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
81 print(f"++++ It is now time to start your Orthanc under tests with configuration file '{config_path}' +++++") |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
82 input("Press Enter to continue") |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
83 else: |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
84 cls.launch_orthanc_under_tests( |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
85 config_name=f"{test_name}", |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
86 storage_name=storage_name, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
87 config=config, |
577 | 88 plugins=Helpers.plugins, |
89 docker_network="auth-test-network" | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
90 ) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
91 |
578 | 92 o = OrthancApiClient(cls.o._root_url, headers={"user-token-key": "token-uploader"}) |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
93 |
578 | 94 o.delete_all_content() |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
95 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
96 # upload a few studies and add labels |
578 | 97 cls.label_a_instance_id = o.upload_file(here / "../../Database/Knix/Loc/IM-0001-0001.dcm")[0] |
98 cls.label_a_study_id = o.instances.get_parent_study_id(cls.label_a_instance_id) | |
99 cls.label_a_series_id = o.instances.get_parent_series_id(cls.label_a_instance_id) | |
100 cls.label_a_study_dicom_id = o.studies.get_tags(cls.label_a_study_id)["StudyInstanceUID"] | |
101 cls.label_a_series_dicom_id = o.series.get_tags(cls.label_a_series_id)["SeriesInstanceUID"] | |
102 cls.label_a_instance_dicom_id = o.instances.get_tags(cls.label_a_instance_id)["SOPInstanceUID"] | |
103 o.studies.add_label(cls.label_a_study_id, "label_a") | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
104 |
578 | 105 cls.label_b_instance_id = o.upload_file(here / "../../Database/Brainix/Epi/IM-0001-0001.dcm")[0] |
106 cls.label_b_study_id = o.instances.get_parent_study_id(cls.label_b_instance_id) | |
107 cls.label_b_series_id = o.instances.get_parent_series_id(cls.label_b_instance_id) | |
108 cls.label_b_study_dicom_id = o.studies.get_tags(cls.label_b_study_id)["StudyInstanceUID"] | |
109 cls.label_b_series_dicom_id = o.series.get_tags(cls.label_b_series_id)["SeriesInstanceUID"] | |
110 cls.label_b_instance_dicom_id = o.instances.get_tags(cls.label_b_instance_id)["SOPInstanceUID"] | |
111 o.studies.add_label(cls.label_b_study_id, "label_b") | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
112 |
578 | 113 instances_ids = o.upload_file(here / "../../Database/Comunix/Pet/IM-0001-0001.dcm") |
114 cls.no_label_study_id = o.instances.get_parent_study_id(instances_ids[0]) | |
115 | |
116 cls.no_label_instance_id = o.upload_file(here / "../../Database/Comunix/Pet/IM-0001-0001.dcm")[0] | |
117 cls.no_label_study_id = o.instances.get_parent_study_id(cls.no_label_instance_id) | |
118 cls.no_label_series_id = o.instances.get_parent_series_id(cls.no_label_instance_id) | |
119 cls.no_label_study_dicom_id = o.studies.get_tags(cls.no_label_study_id)["StudyInstanceUID"] | |
120 cls.no_label_series_dicom_id = o.series.get_tags(cls.no_label_series_id)["SeriesInstanceUID"] | |
121 cls.no_label_instance_dicom_id = o.instances.get_tags(cls.no_label_instance_id)["SOPInstanceUID"] | |
122 | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
123 |
590
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
124 def is_orthanc_version_at_least_1_12_2(self, orthanc_client: OrthancApiClient): |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
125 return orthanc_client.get_system()["ApiVersion"] >= 22 |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
126 |
577 | 127 def assert_is_forbidden(self, api_call): |
128 with self.assertRaises(orthanc_exceptions.HttpError) as ctx: | |
129 api_call() | |
130 self.assertEqual(403, ctx.exception.http_status_code) | |
131 | |
132 | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
133 def test_admin_user(self): |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
134 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
135 o = OrthancApiClient(self.o._root_url, headers={"user-token-key": "token-admin"}) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
136 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
137 # make sure we can access all these urls (they would throw if not) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
138 system = o.get_system() |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
139 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
140 # make sure we can access all studies |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
141 o.studies.get_tags(self.no_label_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
142 o.studies.get_tags(self.label_a_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
143 o.studies.get_tags(self.label_b_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
144 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
145 # make sure we can access series and instances of these studies |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
146 series_ids = o.studies.get_series_ids(self.label_a_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
147 instances_ids = o.series.get_instances_ids(series_ids[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
148 o.instances.get_tags(instances_ids[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
149 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
150 # make sure labels filtering still works |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
151 self.assertEqual(3, len(o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
152 labels=[], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
153 labels_constraint='Any'))) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
154 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
155 self.assertEqual(2, len(o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
156 labels=['label_a', 'label_b'], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
157 labels_constraint='Any'))) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
158 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
159 self.assertEqual(2, len(o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
160 labels=['label_a'], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
161 labels_constraint='None'))) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
162 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
163 all_labels = o.get_all_labels() |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
164 self.assertEqual(2, len(all_labels)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
165 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
166 def test_user_a(self): |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
167 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
168 o = OrthancApiClient(self.o._root_url, headers={"user-token-key": "token-user-a"}) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
169 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
170 # # make sure we can access all these urls (they would throw if not) |
578 | 171 system = o.get_system() |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
172 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
173 all_labels = o.get_all_labels() |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
174 self.assertEqual(1, len(all_labels)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
175 self.assertEqual("label_a", all_labels[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
176 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
177 # make sure we can access only the label_a studies |
577 | 178 self.assert_is_forbidden(lambda: o.studies.get_tags(self.label_b_study_id)) |
179 self.assert_is_forbidden(lambda: o.studies.get_tags(self.no_label_study_id)) | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
180 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
181 # should not raise |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
182 o.studies.get_tags(self.label_a_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
183 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
184 # make sure we can access series and instances of the label_a studies |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
185 series_ids = o.studies.get_series_ids(self.label_a_study_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
186 instances_ids = o.series.get_instances_ids(series_ids[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
187 o.instances.get_tags(instances_ids[0]) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
188 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
189 # make sure we can not access series and instances of the label_b studies |
577 | 190 self.assert_is_forbidden(lambda: o.studies.get_series_ids(self.label_b_study_id)) |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
191 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
192 # make sure tools/find only returns the label_a studies |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
193 studies = o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
194 labels=[], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
195 labels_constraint='Any') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
196 self.assertEqual(1, len(studies)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
197 self.assertEqual(self.label_a_study_id, studies[0].orthanc_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
198 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
199 # if searching Any of label_a & label_b, return only label_a |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
200 studies = o.studies.find(query={}, |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
201 labels=['label_a', 'label_b'], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
202 labels_constraint='Any') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
203 self.assertEqual(1, len(studies)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
204 self.assertEqual(self.label_a_study_id, studies[0].orthanc_id) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
205 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
206 # if searching Any of label_b, expect a Forbidden access |
577 | 207 self.assert_is_forbidden(lambda: o.studies.find(query={}, |
208 labels=['label_b'], | |
209 labels_constraint='Any')) | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
210 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
211 # if searching None of label_b, expect a Forbidden access because we are not able to compute this filter |
577 | 212 self.assert_is_forbidden(lambda: o.studies.find(query={}, |
213 labels=['label_b'], | |
214 labels_constraint='None')) | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
215 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
216 # if searching All of label_b, expect a Forbidden access because we are not able to compute this filter |
577 | 217 self.assert_is_forbidden(lambda: o.studies.find(query={}, |
218 labels=['label_b'], | |
219 labels_constraint='All')) | |
576
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
220 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
221 studies = o.studies.find(query={"PatientName": "KNIX"}, # KNIX is label_a |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
222 labels=[], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
223 labels_constraint='Any') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
224 self.assertEqual(1, len(studies)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
225 |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
226 studies = o.studies.find(query={"PatientName": "KNIX"}, # KNIX is label_a |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
227 labels=['label_a'], |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
228 labels_constraint='Any') |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
229 self.assertEqual(1, len(studies)) |
80ba6f1d521c
new tests for authorization plugin (native only)
Alain Mazy <am@osimis.io>
parents:
diff
changeset
|
230 |
577 | 231 self.assert_is_forbidden(lambda: o.studies.find(query={"PatientName": "KNIX"}, # KNIX is label_a |
232 labels=['label_b'], | |
233 labels_constraint='Any')) | |
234 | |
235 # make sure some generic routes are not accessible | |
236 self.assert_is_forbidden(lambda: o.get_json('patients?expand')) | |
237 self.assert_is_forbidden(lambda: o.get_json('studies?expand')) | |
238 self.assert_is_forbidden(lambda: o.get_json('series?expand')) | |
239 self.assert_is_forbidden(lambda: o.get_json('instances?expand')) | |
240 self.assert_is_forbidden(lambda: o.get_json('studies')) | |
241 self.assert_is_forbidden(lambda: o.get_json('studies/')) | |
242 | |
578 | 243 # make sure the label_a study is accessible (it does not throw) |
244 o.studies.get_tags(self.label_a_study_id) | |
245 o.series.get_tags(self.label_a_series_id) | |
246 o.instances.get_tags(self.label_a_instance_id) | |
247 | |
248 # right now, a user token can not access the dicom-web routes, only a resource token can | |
249 self.assert_is_forbidden(lambda: o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/metadata")) | |
250 | |
577 | 251 |
252 | |
253 def test_resource_token(self): | |
254 | |
590
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
255 o = OrthancApiClient(self.o._root_url, headers={"resource-token-key": "token-a-study"}) |
577 | 256 |
257 # with a resource token, we can access only the given resource, not generic resources or resources from other studies | |
258 | |
259 # generic resources are forbidden | |
578 | 260 self.assert_is_forbidden(lambda: o.studies.find(query={"PatientName": "KNIX"}, # tools/find is forbidden with a resource token |
577 | 261 labels=['label_b'], |
262 labels_constraint='Any')) | |
263 self.assert_is_forbidden(lambda: o.get_all_labels()) | |
264 self.assert_is_forbidden(lambda: o.studies.get_all_ids()) | |
265 self.assert_is_forbidden(lambda: o.patients.get_all_ids()) | |
266 self.assert_is_forbidden(lambda: o.series.get_all_ids()) | |
267 self.assert_is_forbidden(lambda: o.instances.get_all_ids()) | |
268 self.assert_is_forbidden(lambda: o.get_json('patients?expand')) | |
269 self.assert_is_forbidden(lambda: o.get_json('studies?expand')) | |
270 self.assert_is_forbidden(lambda: o.get_json('series?expand')) | |
271 self.assert_is_forbidden(lambda: o.get_json('instances?expand')) | |
578 | 272 self.assert_is_forbidden(lambda: o.get_json('studies')) |
273 self.assert_is_forbidden(lambda: o.get_json('studies/')) | |
577 | 274 |
275 # some resources are still accessible to the 'anonymous' user -> does not throw | |
276 o.get_system() | |
277 o.lookup("1.2.3") # this route is still explicitely authorized because it is used by Stone | |
278 | |
279 # other studies are forbidden | |
280 self.assert_is_forbidden(lambda: o.studies.get_series_ids(self.label_b_study_id)) | |
590
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
281 if self.is_orthanc_version_at_least_1_12_2(o): |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
282 self.assert_is_forbidden(lambda: o.get_binary(f"tools/create-archive?resources={self.label_b_study_id}")) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
283 self.assert_is_forbidden(lambda: o.get_binary(f"tools/create-archive?resources={self.label_b_series_id}")) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
284 # if one of the studies is forbidden, the resource is forbidden |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
285 self.assert_is_forbidden(lambda: o.get_binary(f"tools/create-archive?resources={self.label_b_study_id},{self.label_a_study_id}")) |
577 | 286 |
287 # the label_a study is allowed | |
288 o.studies.get_series_ids(self.label_a_study_id) | |
289 | |
578 | 290 # test with DicomWEB routes + sub-routes |
291 o.get_binary(f"dicom-web/studies/{self.label_a_study_dicom_id}") | |
292 o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/metadata") | |
581 | 293 o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/series") |
578 | 294 o.get_binary(f"dicom-web/studies/{self.label_a_study_dicom_id}/series/{self.label_a_series_dicom_id}") |
295 o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/series/{self.label_a_series_dicom_id}/metadata") | |
296 o.get_binary(f"dicom-web/studies/{self.label_a_study_dicom_id}/series/{self.label_a_series_dicom_id}/instances/{self.label_a_instance_dicom_id}") | |
297 o.get_json(f"dicom-web/studies/{self.label_a_study_dicom_id}/series/{self.label_a_series_dicom_id}/instances/{self.label_a_instance_dicom_id}/metadata") | |
581 | 298 o.get_json(f"dicom-web/studies?StudyInstanceUID={self.label_a_study_dicom_id}") |
299 o.get_json(f"dicom-web/studies?0020000D={self.label_a_study_dicom_id}") | |
300 o.get_json(f"dicom-web/series?0020000D={self.label_a_study_dicom_id}") | |
301 o.get_json(f"dicom-web/instances?0020000D={self.label_a_study_dicom_id}") | |
590
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
302 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
303 if self.is_orthanc_version_at_least_1_12_2(o): |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
304 o.get_binary(f"tools/create-archive?resources={self.label_a_study_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
305 o.get_binary(f"tools/create-archive?resources={self.label_a_series_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
306 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
307 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
308 # now test with token-both |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
309 o = OrthancApiClient(self.o._root_url, headers={"resource-token-key": "token-both-studies"}) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
310 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
311 # other studies are forbidden |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
312 self.assert_is_forbidden(lambda: o.studies.get_series_ids(self.no_label_study_id)) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
313 self.assert_is_forbidden(lambda: o.get_binary(f"tools/create-archive?resources={self.no_label_study_id}")) |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
314 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
315 # any of both or both studies together are allowed |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
316 o.get_binary(f"tools/create-archive?resources={self.label_a_study_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
317 o.get_binary(f"tools/create-archive?resources={self.label_b_series_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
318 o.get_binary(f"tools/create-archive?resources={self.label_b_study_id},{self.label_a_study_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
319 o.get_binary(f"tools/create-archive?resources={self.label_b_study_id},{self.label_a_series_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
320 o.get_binary(f"tools/create-archive?resources={self.label_b_study_id},{self.label_a_instance_id}") |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
321 |
c28bd957cb93
new tests for auth wrt /tools/create-media
Alain Mazy <am@osimis.io>
parents:
581
diff
changeset
|
322 |